@mortar-ai/skill 0.7.2 → 0.7.3

package/manifest.json

@@ -1,8 +1,8 @@
 {
   "schema_version": 1,
   "id": "mortar",
-  "version": "0.7.2",
-  "content_sha256": "sha256:b0240a03057ebc2cf8b831e198e5769644d5ea8a7645b7e5a7a6d22965db2ef1",
+  "version": "0.7.3",
+  "content_sha256": "sha256:292ee5d8a7b9b5c8165142273a452815eb4418f0169937de0833f76bcf34d0e2",
   "source_repo": "liamxujia/appunvs",
   "source_path": "mortar/skill",
   "distributions": [
@@ -11,6 +11,6 @@
   ],
   "npm": {
     "package": "@mortar-ai/skill",
-    "version": "0.7.2"
+    "version": "0.7.3"
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mortar-ai/skill",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Agent skill for building Fabric applications on Appunvs Cloud powered by Mortar, with compact core guidance and on-demand references.",
   "main": "index.js",
   "files": ["SKILL.md", "references", "manifest.json", "index.js", "README.md"],

package/references/auth.md

@@ -13,6 +13,13 @@ const signedIn = await mortar.auth.signInWithPassword({ email, password });
 const sent = await mortar.auth.signInWithOtp({ email }); // or { phone }
 const verified = await mortar.auth.verifyOtp({ email, token });
 
+const providerLogin = await mortar.auth.signInWithProvider({
+  provider: 'google', // apple | google | wechat | alipay
+  connection: 'web',
+  idToken,
+  nonce,
+});
+
 const { data: sessionData } = await mortar.auth.getSession();
 const { data: userData, error: userError } = await mortar.auth.getUser();
 await mortar.auth.signOut();
@@ -22,6 +29,11 @@ Check each returned `error`; do not infer authentication from the presence of UI
 state. Use `onAuthStateChange` when the UI must react to session changes and
 unsubscribe during component/page cleanup.
 
+For provider login, obtain the authorization code or ID token with the
+provider's browser/native SDK and validate OAuth `state` before calling Mortar.
+Use `listOAuthProviders()` to discover the project's public connection IDs.
+Never put provider client secrets or private keys in generated app code.
+
 Password reset starts with `mortar.auth.resetPasswordForEmail(email)` and is
 confirmed with `passwordResetConfirm(email, token, newPassword)`. Never store or
 pass session tokens manually unless the user explicitly needs a trusted server

package/references/openapi.yaml

@@ -577,6 +577,82 @@ paths:
         "401":
           description: invalid_credentials.
 
+  /v1/{tenant}/auth/providers:
+    parameters:
+      - $ref: "#/components/parameters/TenantPath"
+    get:
+      tags: [auth]
+      summary: List configured end-user OAuth provider connections.
+      description: |
+        Returns connection IDs plus public provider client/application IDs for
+        Apple, Google, WeChat, and Alipay. Provider secrets and private keys are
+        never returned. Connections are owned by the Mortar deployment and
+        shared across projects through `MORTAR_AUTH_APPLE`,
+        `MORTAR_AUTH_GOOGLE`, `MORTAR_AUTH_WECHAT`, and `MORTAR_AUTH_ALIPAY`.
+        Projects cannot supply or override provider credentials.
+      security:
+        - APIKey: []
+      responses:
+        "200":
+          description: Configured public provider metadata.
+          content:
+            application/json:
+              schema:
+                type: object
+                required: [providers]
+                properties:
+                  providers:
+                    type: array
+                    items:
+                      $ref: "#/components/schemas/OAuthProviderConfiguration"
+
+  /v1/{tenant}/auth/oauth/{provider}:
+    parameters:
+      - $ref: "#/components/parameters/TenantPath"
+      - name: provider
+        in: path
+        required: true
+        schema:
+          type: string
+          enum: [apple, google, wechat, alipay]
+    post:
+      tags: [auth]
+      summary: Exchange a provider credential for a Mortar User session.
+      description: |
+        The application starts the provider browser/native flow and validates
+        OAuth state before calling this endpoint. Google and Apple accept a
+        signed `id_token` or `authorization_code`; WeChat and Alipay accept an
+        `authorization_code`. A supplied OIDC nonce is checked against the ID
+        token. Successful login resolves a durable provider subject and returns
+        the same Mortar session shape as password and OTP login.
+      security:
+        - APIKey: []
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/OAuthSignInRequest"
+      responses:
+        "200":
+          description: Provider identity verified and Mortar session issued.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/UserAuthResponse"
+        "400":
+          description: provider_credential_required / connection_required / connection_invalid.
+        "401":
+          description: invalid_provider_credential.
+        "404":
+          description: provider_unsupported.
+        "409":
+          description: identity_link_required.
+        "502":
+          description: provider_unavailable.
+        "503":
+          description: provider_not_configured.
+
   /v1/{tenant}/auth/phone/start:
     parameters:
       - $ref: "#/components/parameters/TenantPath"
@@ -2294,6 +2370,53 @@ components:
           type: string
           minLength: 8
 
+    OAuthSignInRequest:
+      type: object
+      properties:
+        connection:
+          type: string
+          description: |
+            Named provider registration. Required when the provider has
+            multiple connections and none is named `default`.
+        authorization_code:
+          type: string
+          description: One-time code returned by the provider flow.
+        id_token:
+          type: string
+          description: Signed Google or Apple OIDC ID token.
+        redirect_uri:
+          type: string
+          format: uri
+          description: Exact redirect URI used to obtain an authorization code.
+        nonce:
+          type: string
+          description: Expected OIDC nonce; checked when supplied.
+        code_verifier:
+          type: string
+          description: Google PKCE verifier used for authorization-code exchange.
+
+    OAuthProviderConfiguration:
+      type: object
+      required: [id, connections]
+      properties:
+        id:
+          type: string
+          enum: [apple, google, wechat, alipay]
+        connections:
+          type: array
+          items:
+            type: object
+            required: [id, client_id]
+            properties:
+              id:
+                type: string
+              client_id:
+                type: string
+                description: Public OAuth client ID or provider AppID.
+              mode:
+                type: string
+                description: Provider-specific mode, such as `mini_program`.
+
     UserAuthResponse:
       type: object
       required: [access_token, user_id, expires_in_sec]